June 16, 2019

June 14, 2019

Subscribe to Latest Legal News and Analysis

June 13, 2019

Subscribe to Latest Legal News and Analysis

HHS-OCR Closes 2017 with Six Figure Settlement in PHI Data Breach Impacting Over 2 Million Individuals

At the end of last year the Department of Health and Human Services – Office for Civil Rights announced its resolution agreement and settlement with 21st Century Oncology for $2.3 million. The company, which billed itself as the largest operator of cancer treatment centers in the world, filed for bankruptcy in May of 2017.  OCR’s press release of the breach settlement stated that 21st Century Oncology was twice notified by the FBI in 2015 that patient information had been illegally obtained and was being sold.  Following notice, the company determined through an internal investigation that the attacker may have accessed its network SQL database through the remote desktop protocol in early October of 2015 and that 2,213,597 individuals were potentially impacted.  Information accessed included names, dates of birth, social security numbers, physicians’ names, diagnoses, treatments, and insurance information.

OCR’s subsequent investigation revealed that the company failed to conduct a thorough security risk assessment; failed to implement appropriate security measures; failed to implement audit logs, access reports, or security incident tracking reports to track system activity; and disclosed protected health information to third party vendors without a written business associate agreement. In addition to the monetary settlement, the company must “complete a risk analysis and risk management plan, revise policies and procedures, educate its workforce on policies and procedures, provide all maintained business associate agreements to OCR, and submit an internal monitoring plan.”

This joins ten other resolution agreements published by OCR in 2017, totaling $19,393,000 in monetary settlements. The healthcare industry continues to be a lucrative target for security breaches, despite increased awareness around cybersecurity.  We expect healthcare breaches taking a top spot in breaches this year.

Putting It Into Practice:  The settlements from 2017 are a reminder to the health care industry to remain prepared. “An ounce of prevention is worth a pound of cure:” we anticipate that OCR will continue to penalize those organizations that do not implement reasonable privacy and security policies and procedures and continually assess their security risks.

Copyright © 2019, Sheppard Mullin Richter & Hampton LLP.


About this Author

Kristi VanderLaan Kung, Sheppard Mullin, fraud abuse counseling lawyer, Anti-Kickback Statute attorney

Kristi Kung is counsel in the Corporate Practice Group in the firm's Washington D.C. office.

Kristi Kung represents healthcare industry clients in a range of regulatory, compliance, and transactional healthcare matters including: fraud and abuse counseling (Anti-Kickback Statute, Stark Law, and False Claims Act issues), internal compliance investigations, responses to government anti-fraud enforcement actions and investigations, responses to reimbursement audits, Medicare/Medicaid enrollment and reimbursement issues, health information privacy...